CVE-2026-72911

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.118.0 ERPNext versions prior to 16.29.0

Description An authenticated user with a common operational role can perform server-side template injection. This occurs because the validate template() and render template() functions in erpnext/accounts/doctype/process statement of accounts/process statement of accounts.py render the subject, body, and pdf name fields using unrestricted globals, including frappe.utils. This allows the attacker to inject template expressions, execute arbitrary server-side code, and read data across the application.

Recommendations Update to version 15.118.0 or newer. Update to version 16.29.0 or newer.